PT-2023-19403 · Pypi+1 · Request+1

Di1L0O · Publicado 2023-02-22 · Atualizado 2025-03-13 · CVE-2023-24107

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions hour of code python 2015 version 520929797b9ca43bb818b2e8f963fb2025459fa3

Description The issue allows attackers to access sensitive user information and execute arbitrary code via a code execution backdoor in the request package, as specified in requirements.txt.

Recommendations For hour of code python 2015 version 520929797b9ca43bb818b2e8f963fb2025459fa3, consider removing or updating the request package in requirements.txt to prevent code execution backdoors. As a temporary workaround, restrict access to sensitive user information until a patch is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2023-24107

Produtos afetados

Hour Of Code Python 2015

Request

Referências · 8

• 🔥 https://github.com/jminh/hour_of_code_python_2015/issues/4 · Exploit
• https://github.com/jminh/hour_of_code_python_2015 · Nota
• https://t.me/cibsecurity/58679 · Publicação no Telegram
• https://t.me/cvenotify/114744 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-24107 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-24107 · Nota de Segurança
• https://mirrors.neusoft.edu.cn/pypi/web/simple/request · Nota
• https://t.me/cvenotify/45372 · Publicação no Telegram